Security

Access follows how a school is organized. Teachers see the classes on their own teams, the children in those classes, and any children they added themselves. Staff at a school see each other’s names, email addresses and photos. School administrators see their school, and district administrators see their district. One district never sees another’s schools, and one school never sees another’s children.

The exception is Mastery Board’s own administrators. They can see and change every district’s records, so they can set up districts and schools, manage accounts and help when something goes wrong. The people who run the service can also reach the database through its hosting account to maintain it.

These rules live in the database, as row-level security on every table. The app has no master key that could read around them: each request runs as the person who is signed in, and the database returns only what that person may see. Steps that need to reach further, such as moving a child to another school or accepting an invitation, are database functions, about forty of them. Each one checks who is asking, and what they are allowed to do, before it does anything.

• Moving a child to another school is limited to district administrators and Mastery Board’s own administrators.
• Taking someone off a team ends their access to that team’s classes and the marks recorded in them at once. They can still see the names of children they entered themselves while they remain at the school.
• Taking someone off a school ends their access to everything at that school at once, including its teams and the children they entered. The school’s and district’s administrators do it themselves, on the school’s console.
• A teacher can add a colleague from the same school to their team, which opens that team’s classes to the colleague.
• Only Mastery Board’s administrators can add or remove districts, or remove schools. A district administrator can also add a school to their own district, and ask for one to be removed, closing it to its staff while the request waits.

• Every account belongs to an adult: a teacher, a school administrator, a district administrator, or one of Mastery Board’s own administrators. There is no sign-up page and no account a child could be given: a child’s record is a row in the school’s records, with no email address, no password and no link to the sign-in service.
• Accounts can only be created from an invitation. The database refuses to create an account for an email address without an invitation that is waiting, including through the sign-in service directly.
• An invitation is sent to one email address and can be used only by the account with that address. It names the school, or the district for a district administrator, and for a teacher can also name a team. It expires after 14 days and can be withdrawn.
• Every account signs in with an email address and a password of at least 8 characters, then a 6-digit code from an authenticator app on the person’s phone, such as Microsoft Authenticator. Each person sets up the app at their first sign-in.
• A district can make the code optional for its teachers. It is required unless the district’s administrators change that, on their console. School administrators, district administrators and Mastery Board’s administrators always give their code, and so does anyone who has set up an app. Someone who works in more than one district gives it if any of them asks.
• The database enforces two-step sign-in as well as the app. Until a session has given a code it needs, the database shows it nothing and lets it change nothing. The one exception: a new account can accept its invitation before it sets up an app.
• If a phone is lost, a school administrator can reset two-step sign-in for staff at their school, and a district administrator for anyone in their district. Neither can reset it for someone who runs, or has been invited to run, a school or district they don’t; Mastery Board’s own administrators can reset it for anyone else. Nobody resets their own. A reset signs the person out everywhere and is recorded in the change log.
• Staff can sign in with their district’s Microsoft work or school account in place of a password, once the district’s Microsoft administrators have approved Mastery Board. Only organizations Mastery Board has named can use it, and the account’s email address must be one Microsoft confirms the organization owns. It stands in for the password only: the code from the authenticator app is still asked for wherever it would be after a password. Sign-in with Google is not offered yet.
• Passwords are never stored. The sign-in provider keeps only a secure one-way hash of each one.
• Password reset links are sent by email, work once, and expire.
• The sign-in and password reset pages don’t reveal whether an email address has an account.
• Signing out ends the session in that browser and only that browser, so signing out of a classroom computer leaves the person’s own iPad signed in.
• Each district chooses how long a browser may sit unused before it is signed out: 1, 4, 8 or 24 hours, 7 or 30 days, or never. A district starts on never until its administrators choose. Someone who works in more than one district has the shortest of their timeouts. Two minutes before, a page left open asks whether the person is still there, with a button to stay signed in.
• When a session ends, saving says so rather than failing quietly, and marks, notes and template changes waiting to save stay on screen.

The database records every change people make to marks, absences and notes, children and the classes they are in, classes and the templates on them, templates and the questions and units inside them, the standards a district or school adds, rewords or retires and the state, grades and subjects a district follows, who has access to districts, schools and teams, a district’s sign-in rules, and resets of two-step sign-in: who made it, when, and what it changed from and to.

• School administrators can read their school’s change log, district administrators their district’s, and Mastery Board’s own administrators all of it. Teachers can’t read it.
• Nobody using the app can write, change or delete an entry.
• Marks and templates are changed a tap or a word at a time, so one person’s marking of one child on one unit, or edits to one template, within the hour are one entry, showing each mark or value before the first change and after the last. Something put back as it was is not listed. Moving questions or units up and down is not recorded, and nor is what a template’s maker does in its first hour: “Made a template” stands for that.
• Invitation links are never recorded.

• In transit: every connection to the app and its database uses HTTPS (TLS).
• At rest: the database and uploaded files are encrypted by Supabase.
• Files: documents and profile photos are kept in private storage. A document is checked against who may see it, then opened through a link the app makes to expire after 60 seconds. A profile photo is checked the same way and sent straight to the browser of the person viewing it. Uploads are limited by type and size: documents to PDF, Word, Excel and images up to 50 MB, photos to 2 MB.
• In the browser: pages tell browsers to use HTTPS only and not to guess file types. When a link leads to another site, the browser tells it only that the visitor came from Mastery Board, never which page. Only Mastery Board itself and Schoology may show its pages inside theirs.
• No tracking: the app loads no advertising, analytics or other third-party scripts.

• The database’s rules are tested automatically. A suite of more than 1,400 checks builds a fresh database from the app’s migrations. It then acts as teachers, administrators and outsiders across two districts, and checks, case by case, what each of them can and cannot see and change, and that records stay consistent.
• Every change to the code is checked automatically when it is pushed: type checks, linting, the test suites and the database suite.
• A code review. In September 2026 we reviewed all of the app’s code and its database, covering access rules, data handling and error handling, and fixed what the review found.

Vercel and Supabase run their own security programs and are independently audited. What each provider handles is on the Privacy page.

• Invite only the staff who need Mastery Board, with the role they need.
• Take people off teams when they change jobs, and off the school when they leave it.
• Keep notes about a child to what they are learning.
• Use a password that isn’t used anywhere else.
• Sign out on a classroom computer, or any computer other people use.

If you think you have found a security problem, or that someone has seen information they shouldn’t have, write to info@abovesoulutions.com. We will reply within two business days, look into it straight away, and keep you told what we find. Please don’t test against other people’s accounts or data.

If information is ever accessed without permission, we will tell every affected school and district within 3 business days of confirming it, by email to their administrators: what happened, which information was involved, what we have done about it, and what we advise the school to do. The first message will not wait for the full picture, and we keep telling them as we learn more. Where the law sets a shorter deadline or asks for more, we meet that as well.